amadey | 0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe
Size

494KB
MD5

aee5bec1f5ecaa221f1bb2db4f7c6eb5
SHA1

1f2a086f422fafc87712fee047839b53d1b86c78
SHA256

0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7
SHA512

07d40d655c6a7c93e0c9b34e0624b4cb134569c1c5f35a00c7d84500f879171e83bda35fd216031d51b6ee6371b439cfcbb1fba2a7261cdfd0bb4ca9ec2e55f7
SSDEEP

6144:0BvLPka847krJpIBaqnfQ/O9PWwtD69etL8etDf18UmS2worfb:KvTka8WkVyBBSguW868etTW/

Score

10^/10

amadey 8fc809 trojan

Malware Config

Extracted

Family

amadey

Version

4.19

Botnet

8fc809

http://nudump.com

http://otyt.ru

http://selltix.org

Attributes

install_dir
b739b37d80
install_file
Dctooux.exe
strings_key
65bac8d4c26069c29f1fd276f7af33f3
url_paths
/forum/index.php

/forum2/index.php

/forum3/index.php

rc4.plain

Signatures

Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
trojan amadey

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe

Executes dropped EXE 3 IoCs

pid	Process
5388	Dctooux.exe
4152	Dctooux.exe
1940	Dctooux.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\Dctooux.job	0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

pid	pid_target	Process	procid_target
4032	4852	WerFault.exe	80
5920	4852	WerFault.exe	80
5380	4852	WerFault.exe	80
3712	4852	WerFault.exe	80
5304	4852	WerFault.exe	80
5148	4852	WerFault.exe	80
3996	4852	WerFault.exe	80
3772	4852	WerFault.exe	80
4676	4852	WerFault.exe	80
2872	4852	WerFault.exe	80
5872	5388	WerFault.exe	104
464	5388	WerFault.exe	104
956	5388	WerFault.exe	104
3528	5388	WerFault.exe	104
5692	5388	WerFault.exe	104
4320	5388	WerFault.exe	104
4520	5388	WerFault.exe	104
1852	5388	WerFault.exe	104
2588	5388	WerFault.exe	104
5804	5388	WerFault.exe	104
5896	5388	WerFault.exe	104
5224	5388	WerFault.exe	104
4648	5388	WerFault.exe	104
1900	5388	WerFault.exe	104
736	5388	WerFault.exe	104
1968	4152	WerFault.exe	140
3712	5388	WerFault.exe	104
1032	1940	WerFault.exe	147
5652	5388	WerFault.exe	104

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4852	0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 5388	4852	0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe	104
PID 4852 wrote to memory of 5388	4852	0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe	104
PID 4852 wrote to memory of 5388	4852	0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe	104

C:\Users\Admin\AppData\Local\Temp\0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe
"C:\Users\Admin\AppData\Local\Temp\0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 756
  2⤵
  - Program crash
  PID:4032
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 804
  2⤵
  - Program crash
  PID:5920
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 788
  2⤵
  - Program crash
  PID:5380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 920
  2⤵
  - Program crash
  PID:3712
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 932
  2⤵
  - Program crash
  PID:5304
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 944
  2⤵
  - Program crash
  PID:5148
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1140
  2⤵
  - Program crash
  PID:3996
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1224
  2⤵
  - Program crash
  PID:3772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1292
  2⤵
  - Program crash
  PID:4676
- C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
  "C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe"
  2⤵
  - Executes dropped EXE
  PID:5388
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 552
    3⤵
    - Program crash
    PID:5872
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 600
    3⤵
    - Program crash
    PID:464
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 616
    3⤵
    - Program crash
    PID:956
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 640
    3⤵
    - Program crash
    PID:3528
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 584
    3⤵
    - Program crash
    PID:5692
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 808
    3⤵
    - Program crash
    PID:4320
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 876
    3⤵
    - Program crash
    PID:4520
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 900
    3⤵
    - Program crash
    PID:1852
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 944
    3⤵
    - Program crash
    PID:2588
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 980
    3⤵
    - Program crash
    PID:5804
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 996
    3⤵
    - Program crash
    PID:5896
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 1020
    3⤵
    - Program crash
    PID:5224
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 1160
    3⤵
    - Program crash
    PID:4648
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 1408
    3⤵
    - Program crash
    PID:1900
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 1444
    3⤵
    - Program crash
    PID:736
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 1528
    3⤵
    - Program crash
    PID:3712
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 5388 -s 880
    3⤵
    - Program crash
    PID:5652
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4852 -s 1272
  2⤵
  - Program crash
  PID:2872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4852 -ip 4852
1⤵
PID:4324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4852 -ip 4852
1⤵
PID:4004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852
1⤵
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4852 -ip 4852
1⤵
PID:5140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 4852 -ip 4852
1⤵
PID:844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4852 -ip 4852
1⤵
PID:5648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4852 -ip 4852
1⤵
PID:4068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4852 -ip 4852
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4852 -ip 4852
1⤵
PID:1688

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4852 -ip 4852
1⤵
PID:1780

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 5388 -ip 5388
1⤵
PID:2104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 5388 -ip 5388
1⤵
PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5388 -ip 5388
1⤵
PID:2924

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 5388 -ip 5388
1⤵
PID:440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5388 -ip 5388
1⤵
PID:2288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 5388 -ip 5388
1⤵
PID:3784

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5388 -ip 5388
1⤵
PID:1816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 5388 -ip 5388
1⤵
PID:2804

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5388 -ip 5388
1⤵
PID:3464

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5388 -ip 5388
1⤵
PID:3296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5388 -ip 5388
1⤵
PID:5972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5388 -ip 5388
1⤵
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5388 -ip 5388
1⤵
PID:5192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 5388 -ip 5388
1⤵
PID:5044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 5388 -ip 5388
1⤵
PID:1352

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:4152
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4152 -s 444
  2⤵
  - Program crash
  PID:1968

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4152 -ip 4152
1⤵
PID:4240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 5388 -ip 5388
1⤵
PID:680

C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe
1⤵
- Executes dropped EXE
PID:1940
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1940 -s 440
  2⤵
  - Program crash
  PID:1032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 384 -p 1940 -ip 1940
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5388 -ip 5388
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\447855248390

Filesize
75KB

MD5
1eac0f9d3982305f5e8bb5ace06e301c

SHA1
b03f334b7c7df0d98dffd62852b8e6c87bbb97a6

SHA256
42106f0056c034f0f390e3fa18b7ce81419bdbfd4d76d7685689d099b018ed9e

SHA512
2e444db492f45c155b1db55626b741ec7f6f3d546913dc22e45afcc83dacb26e9713c4dbe65f4b8c34b6b9571bc6b926c7e89d2c6e38915918ecda2dcf0c2a97

Download Submit
C:\Users\Admin\AppData\Local\Temp\b739b37d80\Dctooux.exe

Filesize
494KB

MD5
aee5bec1f5ecaa221f1bb2db4f7c6eb5

SHA1
1f2a086f422fafc87712fee047839b53d1b86c78

SHA256
0c285d000cd625dca558999244bd59ff813e6d54f88980e4b3c94287777c44b7

SHA512
07d40d655c6a7c93e0c9b34e0624b4cb134569c1c5f35a00c7d84500f879171e83bda35fd216031d51b6ee6371b439cfcbb1fba2a7261cdfd0bb4ca9ec2e55f7

Download Submit
C:\Users\Admin\AppData\Roaming\2eed656dd58e95\cred64.dll

Filesize
153B

MD5
d47b646093dd84d34885a714ce4bd74e

SHA1
c4df23671b6440e29159093dc52cb8c4aa184597

SHA256
6807c84bf35d67496e020c1528303b87d4759933c09817e514a7159ac689d352

SHA512
906fb89d5ec9dc4338f9d5e26fdc9ccc041225157a8f114465449106128d69e9fbc7723b2bcdd56a17c74c29983f7126a1d970b24e3902a3c4e817834f21f338

Download Submit
memory/1940-76-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/4152-54-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/4852-2-0x0000000003FE0000-0x000000000404F000-memory.dmp

Filesize
444KB

Download
memory/4852-3-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4852-1-0x0000000002640000-0x0000000002740000-memory.dmp

Filesize
1024KB

Download
memory/4852-19-0x0000000000400000-0x0000000000472000-memory.dmp

Filesize
456KB

Download
memory/4852-18-0x0000000003FE0000-0x000000000404F000-memory.dmp

Filesize
444KB

Download
memory/4852-17-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/5388-16-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/5388-46-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/5388-36-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/5388-55-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/5388-65-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/5388-71-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download
memory/5388-35-0x0000000000400000-0x0000000002398000-memory.dmp

Filesize
31.6MB

Download